T09 · Insecure Skill Coding Practices
Warning
- Location
- open-link.py:11
- Finding
- Hardcoded Application Signing Credential<![CDATA[ ## Vulnerability Details **File Location**: `open-link.py:11-18`, `web-search.py:11-18`, and `SKILL.md:43` **Vulnerability Type**: Hardcoded cryptographic credential **Risk Level**: Medium ### Vulnerable Code `open-link.py:11-18`: ```python APP_ID = "100003" APP_KEY = "38d2391985e2369a5fb8227d8e6cd5e5" URL = "https://autoglm-api.zhipuai.cn/agentdr/v1/assistant/skills/open-link" TOKEN_URL = "http://127.0.0.1:53699/get_token" def generate_sign(app_id: str, timestamp: int, app_key: str) -> str: raw = f"{app_id}&{timestamp}&{app_key}" ``` `web-search.py:11-18`: ```python APP_ID = "100003" APP_KEY = "38d2391985e2369a5fb8227d8e6cd5e5" URL = "https://autoglm-api.zhipuai.cn/agentdr/v1/assistant/skills/web-search" TOKEN_URL = "http://127.0.0.1:53699/get_token" def generate_sign(app_id: str, timestamp: int, app_key: str) -> str: raw = f"{app_id}&{timestamp}&{app_key}" ``` The same signing key is also disclosed in `SKILL.md:43` as part of the documented MD5 signature formula. ### Technical Analysis The application signing key is embedded directly in two distributed source files and reproduced in the Skill documentation. Any party that can read or download the Skill can recover the value and generate the same `X-Auth-Sign` header as the legitimate scripts. The signature is calculated as an unkeyed MD5 digest over a predictable concatenation of the application ID, current timestamp, and exposed application key: ```python return hashlib.md5(raw.encode()).hexdigest() ``` Because every input to this calculation is known or predictable, possession of the Skill is sufficient to reproduce valid timestamped signatures. MD5 is also a deprecated cryptographic hash and this construction is not a standard message-authentication mechanism such as HMAC. The scripts additionally require a bearer token retrieved from the local token service. Consequently, the exposed application key alone may not provide complete API authentication. However, it removes o ...[truncated 1834 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the disclosed application signing key. 2. Remove the key from both Python scripts and from `SKILL.md`, including repository history and published artifacts where feasible. 3. Perform request signing in a trusted server-side component so distributed clients never receive the signing secret. 4. If client-side signing is unavoidable, provision a unique, revocable credential per installation and load it from protected runtime configuration rather than source code. 5. Replace the raw MD5 construction with a standard message-authentication algorithm such as HMAC-SHA-256 if the API protocol can be changed. 6. Bind signatures to the HTTP method, endpoint, request-body digest, timestamp, and a unique nonce to reduce replay and request-substitution risks. 7. Enforce short timestamp validity windows and server-side nonce tracking. 8. Scope bearer tokens and application credentials to only the required web-search and open-link endpoints, with rate limits and usage monitoring. 9. Add automated secret scanning to the development and release pipelines to prevent credentials from being committed or packaged again. ]]>